I85PREP
⌘ K
CrTAS study materials
CrTAS study resources

CrTAS practice questions

One question at a time. Build your CrTAS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Risk Management Fundamentals and Governance

In a technology risk governance framework, which body typically holds ultimate accountability for accepting residual risk that exceeds the organization's stated tolerance?

  1. The IT service desk supervisor
  2. The external penetration testing vendor
  3. The board of directors or its delegated risk committee Correct answer.
  4. The internal audit function

Explanation

Ultimate accountability for risk acceptance above tolerance rests with the board or a committee to which the board formally delegates that authority. Operational teams, assurance functions, and vendors can recommend or test but cannot own enterprise-level risk acceptance.

Question 2Risk Management Fundamentals and Governance

Which statement best describes the relationship between risk appetite and risk tolerance?

  1. Appetite is the broad amount of risk the organization is willing to pursue; tolerance sets the acceptable variation around specific objectives Correct answer.
  2. Appetite and tolerance are synonyms and are interchangeable in governance documents
  3. Tolerance applies only to financial risk, while appetite applies only to technology risk
  4. Tolerance is the broad amount of risk the organization pursues; appetite is the variation allowed at the objective level

Explanation

Risk appetite expresses the aggregate level and types of risk an organization is willing to accept to achieve its objectives. Risk tolerance translates that appetite into measurable acceptable variation for specific objectives or risk categories.

Question 3Risk Management Fundamentals and Governance

A technology risk register entry records an inherent risk score of high and a residual risk score of medium after controls. What does the residual score represent?

  1. The exposure remaining after existing controls are applied Correct answer.
  2. The cost of implementing the planned controls
  3. The exposure before any controls are considered
  4. The likelihood that a control will fail in the next audit cycle

Explanation

Residual risk is the exposure that remains once the effectiveness of current controls is taken into account. It is the figure governance uses to decide whether further treatment is needed against tolerance.

Question 4Risk Management Fundamentals and Governance

Which of the following is a preventive control rather than a detective control?

  1. Alerting on anomalous outbound data transfers
  2. Mandatory multi-factor authentication at system login Correct answer.
  3. Annual reconciliation of the asset inventory
  4. Monthly review of privileged access reports

Explanation

Preventive controls stop an event from occurring, and enforcing multi-factor authentication before access is granted does exactly that. Reviews, alerts, and reconciliations identify issues after or while they occur, which makes them detective.

Question 5Risk Management Fundamentals and Governance

What is the primary purpose of the three lines model in technology risk governance?

  1. To consolidate all control testing under the IT operations team
  2. To ensure every risk is owned by the internal audit team
  3. To eliminate the need for a board risk committee
  4. To separate risk ownership, oversight, and independent assurance into distinct roles Correct answer.

Explanation

The three lines model clarifies that management owns and manages risk, a risk or compliance function provides oversight, and internal audit gives independent assurance. This separation prevents conflicts of interest in how risk is managed and reported.

Question 6Risk Management Fundamentals and Governance

An organization defines risk criteria for its technology risk framework. Which element belongs in those criteria?

  1. The scales and thresholds used to rate likelihood and impact Correct answer.
  2. The vendor's marketing materials for a security product
  3. The names of individual staff who reported past incidents
  4. The project schedule for the next software release

Explanation

Risk criteria establish how likelihood and impact are rated and what thresholds distinguish low, medium, and high risk. They make risk assessments consistent and comparable across the organization.

Question 7Risk Management Fundamentals and Governance

Which activity best exemplifies risk treatment by transfer?

  1. Documenting a risk in the risk register for monitoring
  2. Purchasing a cyber insurance policy that covers breach response costs Correct answer.
  3. Applying a patch to close a known vulnerability
  4. Deciding to accept a low-rated risk without further action

Explanation

Transfer shifts the financial consequence of a risk to a third party, which is what an insurance policy does. Patching is mitigation, acceptance is retention, and documentation is part of the monitoring process rather than a treatment option.

Question 8Risk Management Fundamentals and Governance

Why does governance require that risk acceptance decisions be documented with an owner, rationale, and expiry or review date?

  1. It removes the need for compensating controls
  2. It creates an auditable record and ensures the acceptance is revisited as conditions change Correct answer.
  3. It transfers legal liability to the risk owner personally
  4. It guarantees the risk will never materialize

Explanation

Documented acceptance with an owner and review date provides accountability and ensures decisions are reconsidered when the environment changes. It supports audit and regulatory evidence without altering the underlying exposure.

Question 9Risk Management Fundamentals and Governance

A risk manager is aggregating technology risks across business units to report to the board. Which approach best supports meaningful aggregation?

  1. Applying consistent rating scales and mapping unit-level risks to shared enterprise risk categories Correct answer.
  2. Excluding risks rated below high to keep the report concise
  3. Reporting only the single highest-rated risk from each unit
  4. Summing raw risk scores from each unit without normalization

Explanation

Aggregation is only meaningful when ratings use consistent scales and unit risks map to common enterprise categories, so the board can compare and combine exposures. Simple summation or selective exclusion distorts the enterprise view.

Question 10Risk Management Fundamentals and Governance

A critical payment system has a recovery time objective of four hours, but testing shows actual recovery takes twelve hours. What is the most appropriate governance action?

  1. Record the gap as a risk with an owner and remediation plan, and report it through the risk committee Correct answer.
  2. Suppress the test result because the system has never failed in production
  3. Delegate the decision to the application vendor without escalation
  4. Change the recovery time objective to twelve hours to close the gap on paper

Explanation

A recovery capability that misses the stated objective is a genuine risk that must be recorded, owned, and escalated for treatment decisions. Adjusting the objective purely to match performance, without business approval, masks the exposure.

Question 11Risk Management Fundamentals and Governance

Which statement correctly distinguishes a risk from an issue in technology risk governance?

  1. Risks and issues are identical and are tracked in the same field of the register
  2. A risk is a potential future event, while an issue is a problem that has already occurred and requires remediation Correct answer.
  3. An issue is recorded only in audit reports, while risks appear only in project plans
  4. A risk is always high severity, while an issue is always low severity

Explanation

Risks describe uncertain future events that may affect objectives, whereas issues are realized problems needing active remediation. Keeping them distinct clarifies whether treatment or resolution is required.

Question 12Risk Management Fundamentals and Governance

A business unit wants to adopt a new cloud service. Under a well-designed risk governance process, when should the risk assessment occur?

  1. Before the service is approved and onboarded, with reassessment at defined intervals Correct answer.
  2. Only at the annual external audit
  3. Only after the first security incident occurs
  4. After the contract has been signed and data migrated

Explanation

Risk assessment should inform the approval decision, so it must precede onboarding and be refreshed at defined intervals. Assessing after migration or only after an incident leaves the organization exposed without a decision record.

Question 13Risk Management Fundamentals and Governance

What is the role of key risk indicators in a technology risk governance program?

  1. To provide early-warning metrics that signal rising exposure against defined thresholds Correct answer.
  2. To replace the risk register entirely
  3. To document the technical configuration of each server
  4. To measure employee satisfaction with IT services

Explanation

Key risk indicators are forward-looking metrics with thresholds that flag when exposure is trending beyond tolerance. They complement the risk register by giving early warning rather than replacing it.

Question 14Risk Management Fundamentals and Governance

A risk owner disagrees with the assigned residual rating and believes it is too high. What is the most appropriate governance response?

  1. Unilaterally lower the rating in the register without review
  2. Escalate directly to the regulator before internal review
  3. Challenge the assessment through the defined review process with supporting evidence Correct answer.
  4. Ignore the rating and proceed without documenting the disagreement

Explanation

Ratings should be contestable through a documented review that weighs evidence, preserving consistency and accountability. Unilateral changes or undocumented departures undermine the integrity of the framework.

Question 15Risk Management Fundamentals and Governance

Which practice best demonstrates a risk-aware culture rather than a compliance-only culture?

  1. Staff at all levels raise concerns and near misses without fear, and leaders act on them visibly Correct answer.
  2. Leaders discuss risk only when an audit finding is issued
  3. Staff complete annual security training only to satisfy an audit requirement
  4. Incident reports are restricted to senior management to avoid reputational damage

Explanation

A risk-aware culture encourages open reporting of concerns and near misses and shows leaders responding constructively. Compliance-only cultures treat risk activity as a box-ticking exercise tied to audits.

Question 16Risk Management Fundamentals and Governance

An organization outsources a critical function to a third party. Which governance arrangement best preserves accountability?

  1. Transfer all accountability for the function to the vendor permanently
  2. Define contractual risk and reporting obligations, monitor vendor performance, and retain internal ownership of the outsourced risk Correct answer.
  3. Rely on the vendor's self-assessment without independent verification
  4. Assume the vendor's certifications eliminate the need for ongoing monitoring

Explanation

Outsourcing transfers activity but not accountability, so the organization must set contractual obligations, monitor performance, and keep an internal risk owner. Vendor certifications inform but do not replace ongoing oversight.

Question 17Risk Management Fundamentals and Governance

What distinguishes inherent risk assessment from control effectiveness assessment in a risk register?

  1. Inherent risk rates control cost; control effectiveness rates control ownership
  2. Inherent risk is set by auditors; control effectiveness is set by vendors
  3. Inherent risk rates exposure without controls; control effectiveness rates how well controls reduce that exposure Correct answer.
  4. Inherent risk applies only to financial risk; control effectiveness applies only to technology risk

Explanation

Inherent risk captures exposure assuming no controls, while control effectiveness evaluates how much the existing controls reduce that exposure to residual levels. Keeping them separate makes the contribution of controls transparent.

Question 18Risk Management Fundamentals and Governance

A regulator introduces a new requirement for incident reporting within 72 hours. How should the governance framework respond?

  1. Apply the requirement only to systems managed by external vendors
  2. Wait until the next annual policy review cycle regardless of the effective date
  3. Update policies, assign ownership, and revise risk criteria and reporting workflows to reflect the obligation Correct answer.
  4. Record the requirement as an accepted risk without any process change

Explanation

New regulatory obligations are compliance drivers that require timely updates to policy, ownership, and reporting processes. Deferring them or applying them selectively creates a demonstrable compliance gap.

Question 19Risk Management Fundamentals and Governance

Which metric is the strongest evidence that a risk treatment plan is actually reducing exposure?

  1. A downward trend in the residual risk rating supported by control testing results Correct answer.
  2. The total count of risks entered in the register
  3. The volume of policy documents published this quarter
  4. The number of meetings held by the risk committee

Explanation

Reduced exposure is demonstrated when residual ratings decline and control testing confirms the controls work as intended. Activity counts measure effort, not whether exposure actually changed.

Question 20Risk Management Fundamentals and Governance

An organization uses a 5x5 likelihood and impact matrix. Two risks both score 16, but one relates to customer data and the other to internal stationery supplies. Why might governance treat them differently?

  1. Risk criteria should reflect the nature and consequence of the asset, so identical scores can carry different business significance Correct answer.
  2. The matrix is invalid if two risks share a score
  3. Stationery risks must always be escalated to the board
  4. Identical scores always require identical treatment regardless of context

Explanation

A numeric score compresses information, and governance criteria should account for the nature of the affected asset and consequence. Two equal scores can therefore warrant different urgency and escalation.

Question 21Risk Management Fundamentals and Governance

A risk committee observes that the same high-rated risk has remained open for three cycles with no change in treatment status. What does this pattern most likely indicate?

  1. That the risk register is functioning as designed
  2. That the risk has been effectively mitigated
  3. Weak treatment ownership or ineffective escalation, which the committee should challenge Correct answer.
  4. That the risk should be closed automatically after three cycles

Explanation

A persistent high risk with no movement in treatment suggests the owner is not driving remediation or escalation is failing. The committee should challenge the owner and require a credible plan rather than accept stagnation.

Question 22Risk Management Fundamentals and Governance

A board asks whether the organization's risk appetite for technology risk is being respected. Which combination of evidence best answers the question?

  1. Residual risk profile against tolerance thresholds, plus breaches and their approved exceptions Correct answer.
  2. The vendor list and the age of the data center
  3. The number of IT staff employed and the size of the IT budget
  4. The count of security policies and their publication dates

Explanation

Appetite compliance is evidenced by comparing the residual risk profile to defined tolerance thresholds and reviewing breaches with approved exceptions. Resource and documentation counts do not show whether exposure sits within tolerance.

Question 23Risk Management Fundamentals and Governance

A risk owner proposes accepting a risk that exceeds tolerance because the cost of treatment exceeds the potential loss. What is the correct governance position?

  1. Acceptance above tolerance requires escalation to the body with delegated authority, supported by a documented cost-benefit rationale Correct answer.
  2. The treatment cost should be hidden in the operational budget to avoid scrutiny
  3. The risk owner may accept it unilaterally because the cost-benefit analysis is favorable
  4. The risk must be removed from the register to avoid reporting a breach

Explanation

Owners can accept risk only within their delegated limits; anything above tolerance must be escalated with a documented rationale for a decision by the authorized body. Unilateral acceptance or concealment breaches the framework.

Question 24Risk Management Fundamentals and Governance

Which situation best illustrates concentration risk that aggregation should surface to the board?

  1. Multiple business units independently depend on the same identity provider, so a single outage affects all of them Correct answer.
  2. A low-rated risk is closed after controls are verified
  3. A vendor passes an annual security assessment
  4. One unit reports a high risk that is unique to its own operations

Explanation

Aggregation reveals correlated exposures, such as many units relying on one provider, where a single failure creates enterprise-wide impact. Isolated or closed risks do not represent concentration.

Question 25Risk Management Fundamentals and Governance

What is the most appropriate way to treat a risk whose likelihood is very low but whose impact would be catastrophic and unrecoverable?

  1. Rate it low overall because likelihood dominates the score
  2. Exclude it from the register because it is unlikely
  3. Rely solely on historical frequency data to justify inaction
  4. Evaluate it against impact-based tolerance and consider avoidance, transfer, or specific contingency planning Correct answer.

Explanation

Catastrophic, unrecoverable impacts may exceed tolerance regardless of low likelihood, so governance should consider avoidance, transfer, or contingency planning. Pure likelihood weighting can wrongly dismiss tail risks.

Question 26Risk Management Fundamentals and Governance

In a technology risk governance framework, what is the primary purpose of a three-lines model arrangement?

  1. To separate the functions that own and manage risk from those that provide independent oversight and assurance Correct answer.
  2. To guarantee that operational staff report directly to the board on risk matters
  3. To centralize all risk decisions in the internal audit function
  4. To ensure that every technology risk is eliminated before systems enter production

Explanation

The three-lines model assigns risk ownership and management to the first line, independent risk and compliance oversight to the second line, and independent assurance to the third line. Its purpose is to create clear separation so that those taking risk are not solely responsible for judging their own controls. This structure strengthens accountability and objectivity in technology risk governance.

Question 27Risk Management Fundamentals and Governance

Which statement best describes the concept of risk appetite in technology risk governance?

  1. The maximum loss the organization could theoretically suffer from any single incident
  2. The amount and type of technology risk an organization is willing to accept in pursuit of its objectives Correct answer.
  3. The set of controls the organization has implemented to reduce residual risk
  4. The list of regulatory requirements the organization must comply with

Explanation

Risk appetite expresses the level and nature of risk an organization is willing to pursue or retain to achieve its objectives. It is set by senior leadership and the board and guides decisions about which risks to take, treat, or avoid. It is distinct from controls, which are the means used to keep risk within that appetite.

Question 28Risk Management Fundamentals and Governance

A technology risk team is defining the escalation path for risks that breach tolerance. Which design choice best supports effective governance?

  1. Escalate only after a loss event has already occurred
  2. Define pre-agreed thresholds and timeframes that trigger escalation to a named committee Correct answer.
  3. Allow risk owners to decide independently whether escalation is needed
  4. Escalate every risk regardless of rating so that no risk is overlooked

Explanation

Effective escalation depends on predefined thresholds and timeframes that automatically trigger reporting to a named accountable body. This removes discretion and delay from the process and ensures breaches reach decision-makers promptly. Clear ownership of the escalation destination also makes the outcome of escalation predictable.

Question 29Risk Management Fundamentals and Governance

An organization is establishing a risk register for technology risk. Which attribute is most essential for enabling governance oversight of each entry?

  1. The date the underlying system was originally procured
  2. A named risk owner accountable for the risk and its treatment Correct answer.
  3. The technical vendor name associated with the affected system
  4. The number of staff who have access to the system

Explanation

A named risk owner is essential because governance requires a specific accountable person for each risk and its treatment decisions. Without clear ownership, oversight bodies cannot hold anyone accountable or track whether treatment is progressing. Other attributes may be useful context but do not provide that accountability link.

Question 30Risk Management Fundamentals and Governance

A board risk committee notices that technology risk reporting focuses almost entirely on past incident counts. Which change would most improve the reporting's usefulness for forward-looking governance?

  1. Adding forward-looking indicators such as control drift, vulnerability aging, and near-miss trends alongside incident data Correct answer.
  2. Reducing reporting frequency to lower the volume of data presented
  3. Adding more historical incident detail to each report
  4. Replacing incident data entirely with a single aggregate risk score

Explanation

Backward-looking incident counts show what has already happened, whereas governance needs signals of emerging exposure. Forward-looking indicators such as control drift, aging vulnerabilities, and near-miss trends reveal deteriorating conditions before losses occur. Combining these with incident data gives the committee a balanced view of past performance and future risk.

Question 31Market Risk Measurement and Management

A portfolio has a one-day 99% VaR of USD 2.0 million. Under the square-root-of-time rule, what is the approximate ten-day 99% VaR?

  1. USD 2.63 million
  2. USD 0.63 million
  3. USD 20.0 million
  4. USD 6.32 million Correct answer.

Explanation

The square-root-of-time scaling assumes independent, identically distributed daily returns, so the ten-day VaR equals the one-day VaR times the square root of ten. That gives 2.0 million x 3.162, approximately USD 6.32 million. The rule understates risk when returns are positively autocorrelated or when positions cannot be liquidated quickly.

Question 32Market Risk Measurement and Management

Which statement best describes the historical simulation approach to Value-at-Risk?

  1. It revalues the current portfolio against a set of past market-factor changes and reads the loss quantile from the resulting distribution. Correct answer.
  2. It estimates VaR by simulating random factor paths from a fitted parametric distribution.
  3. It assumes portfolio returns are normally distributed and derives the quantile from a covariance matrix.
  4. It computes VaR from a closed-form delta-normal approximation using only first moments.

Explanation

Historical simulation is a full-revaluation, non-parametric method: historical changes in risk factors are applied to today's positions to build an empirical profit-and-loss distribution, and the VaR is the appropriate percentile. It makes no explicit distributional assumption but inherits the sample period's coverage. Parametric and Monte Carlo methods are distinct approaches.

Question 33Market Risk Measurement and Management

A bank's VaR model is validated using the traffic-light approach with 250 trading days. The number of exceptions falls in the yellow zone. What is the most appropriate regulatory interpretation?

  1. No action is required because any exception count below 250 is within tolerance.
  2. The bank must switch from VaR to expected shortfall for the following year.
  3. The model is presumed acceptable but the multiplier applied to capital may increase and supervisory scrutiny is warranted. Correct answer.
  4. The model is rejected outright and the bank must immediately cease using it for capital purposes.

Explanation

The Basel traffic-light framework classifies backtesting exceptions into green, yellow and red zones. Yellow-zone results suggest the model may still be usable but typically trigger a higher capital multiplier and closer supervisory review. Red-zone results, by contrast, indicate serious model deficiency.

Question 34Market Risk Measurement and Management

Which measure is coherent in the sense of satisfying subadditivity for all portfolios?

  1. Value-at-Risk at 99%
  2. Standard deviation of profit and loss
  3. VaR at 95%
  4. Expected shortfall Correct answer.

Explanation

Expected shortfall, the average loss conditional on exceeding the VaR threshold, satisfies monotonicity, translation invariance, positive homogeneity and subadditivity, making it coherent. VaR can violate subadditivity for non-elliptical distributions, which is a key motivation for its regulatory replacement.

Question 35Market Risk Measurement and Management

A trader holds a long position in a call option. Which statement about the delta-normal VaR of this position is most accurate?

  1. It cannot be computed because options have no delta exposure.
  2. It is exact because option payoffs are linear in the underlying price.
  3. It overstates risk because delta is always larger than one for a long call.
  4. It ignores the option's gamma and therefore understates risk for large moves in the underlying. Correct answer.

Explanation

Delta-normal VaR linearises the option payoff using the first derivative, so it captures only delta exposure. For large underlying moves the curvature (gamma) makes actual losses larger than the linear approximation implies, so risk is understated. Full revaluation or delta-gamma approaches address this limitation.

Question 36Market Risk Measurement and Management

Under the Basel internal models approach, which input is required for the stressed expected shortfall calculation?

  1. A calibration period chosen to reflect a period of significant stress for the bank's portfolio Correct answer.
  2. A hypothetical scenario supplied by the supervisor each quarter
  3. The most recent twelve months of market data only
  4. The average of the bank's own historical simulation and a normal-distribution parametric estimate

Explanation

Stressed expected shortfall requires the model to be calibrated to a continuous twelve-month period of significant stress relevant to the current portfolio. This reduces procyclicality relative to a purely current-period calibration. The stress period is bank-specific and must be justified to the supervisor.

Question 37Market Risk Measurement and Management

A risk manager computes a 95% one-day VaR of USD 1 million. Which interpretation is correct?

  1. The maximum possible loss on any single day is USD 1 million.
  2. On approximately 5% of trading days, losses are expected to exceed USD 1 million, assuming the model is accurate. Correct answer.
  3. The portfolio will lose exactly USD 1 million on one day in twenty.
  4. There is a 95% probability that the portfolio will gain more than USD 1 million.

Explanation

VaR is a quantile of the loss distribution: at 95% confidence, losses exceed the VaR threshold on about 5% of days. It says nothing about the size of losses beyond the threshold. It is not a worst-case bound and not a deterministic frequency statement.

Question 38Market Risk Measurement and Management

Which data issue most directly causes a historical-simulation VaR model to understate risk during a volatility regime change?

  1. The model uses full revaluation instead of a delta approximation.
  2. The lookback window contains mostly low-volatility observations and no comparable stress episodes. Correct answer.
  3. The portfolio contains too many linear instruments.
  4. The confidence level is set at 99% rather than 95%.

Explanation

Historical simulation is only as representative as its sample. If the lookback window is dominated by calm markets, extreme observations are absent and the empirical tail is too thin, understating VaR exactly when volatility rises. Longer windows or stressed calibration periods mitigate this.

Question 39Market Risk Measurement and Management

A portfolio's daily profit and loss has a mean of zero and a standard deviation of USD 500,000. Assuming normality, what is the approximate one-day 99% VaR? (z(0.99) = 2.326)

  1. USD 0.500 million
  2. USD 2.326 million
  3. USD 1.163 million Correct answer.
  4. USD 0.822 million

Explanation

Under the parametric normal approach with zero mean, VaR equals the z-score times the standard deviation of profit and loss. Multiplying 2.326 by 500,000 gives approximately USD 1.163 million. This linear scaling is the basis of variance-covariance VaR.

Question 40Market Risk Measurement and Management

Which statement about the relationship between VaR and expected shortfall at the same confidence level is correct?

  1. Expected shortfall and VaR are unrelated and can be ordered either way arbitrarily.
  2. Expected shortfall is at least as large as VaR and captures the average severity of losses beyond the VaR threshold. Correct answer.
  3. Expected shortfall is always smaller than VaR because it averages over tail losses.
  4. Expected shortfall equals VaR whenever returns are fat-tailed.

Explanation

By construction, expected shortfall averages losses in the tail beyond the VaR quantile, so it is greater than or equal to VaR at the same confidence level. It also conveys information about tail magnitude, which VaR omits. Equality occurs only in degenerate cases where the tail has no spread.

Question 41Market Risk Measurement and Management

A bank's VaR model produces 250 daily forecasts. Backtesting at 99% yields 8 exceptions. Using a binomial approximation, which conclusion is most defensible?

  1. The result is uninformative because backtesting requires at least 1,000 observations.
  2. Eight exceptions materially exceed the expected 2.5 and suggest the model understates risk, warranting investigation. Correct answer.
  3. Eight exceptions are below the expected number and indicate an overly conservative model.
  4. The result proves the return distribution is normal.

Explanation

At 99% confidence over 250 days the expected exception count is 2.5. Observing 8 is more than triple the expectation and lies well into the yellow or red region of the traffic-light framework, indicating possible underestimation of risk. It calls for model review rather than an immediate conclusion about distributional form.

Question 42Market Risk Measurement and Management

Which scenario-generation method for Monte Carlo VaR is most consistent with preserving the empirical dependence structure among risk factors?

  1. Estimating a covariance matrix and drawing correlated multivariate normal shocks Correct answer.
  2. Applying a single common shock to all risk factors
  3. Using only the diagonal of the covariance matrix for the draws
  4. Drawing each risk factor independently from its own historical distribution

Explanation

Correlated draws from an estimated covariance matrix, often via Cholesky decomposition, preserve the linear dependence among factors. Independent draws or diagonal-only approaches discard correlation and misstate portfolio risk. Copula methods can extend this to non-normal dependence.

Question 43Market Risk Measurement and Management

Which of the following best explains why VaR is often criticized as ignoring tail risk?

  1. VaR requires the assumption of normally distributed returns in all implementations.
  2. VaR is computed only from historical data and cannot use parametric methods.
  3. VaR cannot be backtested and therefore cannot be validated.
  4. VaR reports a quantile threshold but says nothing about how large losses are once that threshold is breached. Correct answer.

Explanation

VaR is a single quantile and is silent about the severity of losses beyond it. Two portfolios with the same VaR can have very different tail exposures. Expected shortfall was introduced partly to address this blind spot.

Question 44Market Risk Measurement and Management

A portfolio has exposures to two risk factors whose returns are perfectly negatively correlated. Under a parametric variance-covariance approach, what happens to portfolio VaR relative to the sum of the standalone VaRs?

  1. It is unchanged because VaR is additive regardless of correlation.
  2. It is lower because the negative correlation produces diversification benefits. Correct answer.
  3. It becomes zero whenever correlation is negative.
  4. It is higher because negative correlation increases volatility.

Explanation

In the variance-covariance framework, portfolio variance includes a covariance term that is negative when correlations are negative, reducing total volatility and hence VaR. VaR is subadditive here, so the combined figure is below the sum of standalone VaRs. It reaches zero only in the special case of exactly offsetting exposures.

Question 45Market Risk Measurement and Management

Which component of the Basel market risk capital framework is intended to capture the risk of losses under stressed market conditions that the current-period measure may miss?

  1. The multiplication factor applied to the current VaR
  2. The incremental risk charge for default risk
  3. The comprehensive risk measure for correlation trading
  4. Stressed expected shortfall calibrated to a period of significant stress Correct answer.

Explanation

Stressed expected shortfall uses a stress-period calibration so that capital reflects tail losses observed in turbulent markets. The multiplier scales the current measure but does not itself add stress calibration. Incremental and comprehensive risk charges address specific risk categories rather than general stress calibration.

Question 46Market Risk Measurement and Management

A risk analyst is told that a portfolio's 99% expected shortfall is USD 4 million while its 99% VaR is USD 3 million. Which statement is most consistent with these figures?

  1. Conditional on a loss exceeding USD 3 million, the average loss is about USD 4 million. Correct answer.
  2. The largest possible loss is USD 4 million.
  3. The portfolio's standard deviation equals USD 1 million.
  4. Losses exceed USD 4 million on 1% of days.

Explanation

Expected shortfall is the mean of losses in the tail beyond the VaR threshold. With VaR of 3 million and ES of 4 million, the average loss given a breach of the VaR level is about 4 million. It is not a maximum loss nor a probability statement about exceeding the ES level.

Question 47Market Risk Measurement and Management

Which practice most directly reduces procyclicality in regulatory market risk capital?

  1. Removing the capital multiplier during calm markets
  2. Computing VaR at a lower confidence level
  3. Relying solely on the most recent 60 days of market data
  4. Using a stressed calibration period for the tail measure alongside the current-period measure Correct answer.

Explanation

Procyclicality arises when capital falls in calm periods and spikes in stress. Combining a current-period measure with a stressed calibration smooths capital across the cycle and ensures capital is held for stressed conditions. Short windows and multiplier reductions would amplify procyclicality.

Question 48Market Risk Measurement and Management

A bank uses a variance-covariance VaR model for a portfolio of equities with fat-tailed returns. Which consequence is most likely?

  1. VaR is unaffected because the covariance matrix fully captures tail behaviour.
  2. VaR is overstated because fat tails concentrate mass near the mean.
  3. VaR becomes coherent because fat tails restore subadditivity.
  4. VaR at high confidence levels is understated because the normal assumption assigns too little probability to extreme losses. Correct answer.

Explanation

The normal distribution thins the tails relative to observed equity returns, so high-confidence quantiles are underestimated. Fat tails mean more probability mass in extreme outcomes than the normal model allows. This is a central motivation for historical simulation, EVT and expected shortfall.

Question 49Market Risk Measurement and Management

Which statement about the use of extreme value theory in market risk measurement is most accurate?

  1. It models the tail of the loss distribution directly, often using a generalized Pareto distribution for excesses over a high threshold. Correct answer.
  2. It replaces the need for any threshold selection or parameter estimation.
  3. It assumes losses are bounded above by the sample maximum.
  4. It is applicable only to credit risk, not market risk.

Explanation

Extreme value theory focuses on the tail rather than the whole distribution. The peaks-over-threshold approach fits a generalized Pareto distribution to losses exceeding a high threshold, enabling extrapolation to quantiles beyond the sample. Threshold choice and parameter uncertainty remain practical challenges.

Question 50Market Risk Measurement and Management

A portfolio manager wants to estimate the VaR contribution of each desk so that the contributions sum to total portfolio VaR. Which approach is designed for this?

  1. Assigning equal VaR to each desk regardless of size
  2. Component VaR based on the Euler allocation of the portfolio variance or quantile Correct answer.
  3. Averaging each desk's standalone VaR
  4. Computing each desk's standalone VaR and summing them

Explanation

Component VaR uses an Euler decomposition so that individual contributions add exactly to total portfolio VaR while accounting for diversification. Standalone VaRs ignore correlation and generally sum to more than the portfolio figure. Equal allocation ignores risk entirely.